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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

• If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

• Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1)S Responsive to communication(s) filed on 06 April 2004 . 
2a)D This action is FINAL. 2b)[3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Qway/e, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-30 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^ Claim(s) 1-30 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) K The drawing(s) filed on 8/31/2001 is/are: a)|3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 1 1 9 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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2) C] Notice of Draftsperson's Patent Drawing Review (PTO-948) 
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Paper No(s)/Mail Date 8/01. 10/01. 4/04 . 



4) O Interview Summary (PTO-413) 
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5) CD Notice of Informal Patent Application (PTO-152) 
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U.S. Patent and Trademark Office 
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DETAILED ACTION 

PRIOR ART 

The Examiner cites art made of record and not relied upon and yet is considered 
pertinent to applicant's disclosure. The art disclosed general background. 
http://ww.bindview.com/Support/RAZOR/Papers/2000/DDSA Defense.cfm is dated as 
from year 2000 by http://www.bindview.com/support/Razor/Papers . 
This Bindview sells Zombie zappers. 

CLAIMS PRESENTED 

Claims 1 -30 are presented. 

CLAIM REJECTIONS 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 

Claims 1-30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
http://www.sans.org/dosstep/index.php ("Sans"). 

Regarding claim 1 , Sans teaches "A method for detecting computer hacker 
denial of service attacks, comprising the steps of: issuing a bit mapped challenge in 



Application/Control Number: 09/945,172 Page 3 

Art Unit: 2134 

response request from a requester of services; and login responsive to an incorrect 
response to said challenge, placing said requester in a state of ... service (Step 2.2: 
Test your network ...: using ping command to issue a bit mapped challenge)." 

These passages of Sans do not teach "limited" service in the sense of the claim. 
Instead, Sans appears to imply that the service should be entirely cut off if the network 
is being used as a broadcast amplification site. 

Nevertheless, it was well known in the art to have a "limited" service for the 
motivation of having the option to further track the requestor who may not request again 
if the service is entirely cut off. 

Hence, it would have been obvious to those of ordinary skill in the art at the time 
of the claimed invention to modify Sans for the motivation noted in the previous 
paragraphs so as to teach the claimed invention. 

Regarding claim 2 (filter, etc.), such particular features are well known in the art 
for the purpose of security. 

Regarding claim 3 (delay of networks, etc.), such particular features are well 
known in the art for the purpose of detecting denial of service. Indeed, such delay is a 
denial of service. Regarding claims 4-10, such particular features are well known in the 
art for the purpose of handling information across computers and of security. 

Regarding claim 1 1 , Sans teaches "A method for detecting computer hacker 
denial of service attacks, comprising the steps of: executing a challenge-response login 
procedure and network probing test frame transmission and analysis procedure to 
detect a hacker denial of service attack; and responsive to detecting said denial of 
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service attack, placing said hacker in a ... level of service state. (Step 2.2: Test your 
network ...: using ping command to issue a bit mapped challenge)." 

These passages of Sans do not teach service in the sense of the claim. 
Instead, Sans appears to imply that the service should be entirely cut off if the network 
is being used as a broadcast amplification site. 

Nevertheless, it was well known in the art to have a service for the 
motivation of having the option to further track the requestor who may not request again 
if the service is entirely cut off. 

Hence, it would have been obvious to those of ordinary skill in the art at the time 
of the claimed invention to modify Sans for the motivation noted in the previous 
paragraphs so as to teach the claimed invention. 

Regarding claims 12-17, such particular features are well known in the art for the 
purpose of handling information across computers and of security. 

Regarding claim 18, Sans teaches "A system for detecting and responding to 
denial of service attacks, comprising: test station for identifying a zombie source of said 
denial of service attack; a ... quality server for serving said zombie source; and a high 
quality server serving legitimate sources of request for services (Step 2.2: Test your 
network ... : using ping command to issue a bit mapped challenge)." 

These passages of Sans do not teach "low" quality server in the sense of the 
claim. Instead, Sans appears to imply that the service should be entirely cut off if the 
network is being used as a broadcast amplification site. 
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Nevertheless, it was well known in the art to have a "low" quality server for the 
motivation of having the option to further track the requestor who may not request again 
if the service is entirely cut off. 

Hence, it would have been obvious to those of ordinary skill in the art at the time 
of the claimed invention to modify Sans for the motivation noted in the previous 
paragraphs so as to teach the claimed invention. 

Regarding claims 18-30, such particular features are well known in the art for the 
purpose of handling information across computers and of security. 

Conclusion 
Points of Contact 

Any response to this action should be mailed to: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

or faxed to: 

(703) 746-7239, (for formal communications intended for entry) 



Or: 
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(703) 746-5606 (for informal or draft communications, please label "PROPOSED" or 
"DRAFT") 

Hand-delivered responses should be brought to Crystal Park II, 2121 Crystal Drive, 
Arlington. VA., Sixth Floor (Receptionist). 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Jung whose telephone number is (571 ) 272-3836 
or Greg Morse whose telephone number is (571 ) 272-3838. 



David Jung 

Patent Examiner 
12/13/04 




